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Alice and Bob share a correlated composite quantum system AB. If AB is 
used as the key for a one-time pad cryptographic system, we show that the 

^ ■ maximum amount of information that Alice can send securely to Bob is the 

^ . quantum mutual information of AB. 
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1 The one-time pad and mutual information 



c^ ■ A one-time pad yij is a cryptographic protocol in which communicators Alice 

and Bob initially have correlated random variables, collectively called the 
"key", that are not correlated with any variables possessed by a potential 
eavesdropper Eve. (In most discussions, the key variables possessed by Alice 
and Bob are supposed to be perfectly correlated — e.g., they are identical 
copies of the same secret string of bits. We consider the more general case.) 
If the key variables are used only once, they allow Alice to send Bob a 
perfectly secret message over a public communication channel. The value of 
a key as a resource is the amount of information that can be sent secretly by 
its use. 



In this paper we examine a quantum mechanical analogue of the one-time 
pad. Alice and Bob initially share a correlated composite quantum system 
AB. Alice encodes a classical message by performing one of several possible 
operations on her subsystem A, after which she transfers it to Bob. Bob reads 
the message via a measurement on the entire system AB. The eavesdropper 
Eve only has access to subsystem A; thus, to ensure the security of the secret 
message, Alice must ensure that the A by itself can provide no information 
to Eve. 

Holevo ^ provided an upper bound for the accessible information in a 
measurement. Suppose a quantum system is prepared in a state pa with 
probability Pa- The ensemble average state is p = y^jpaPa- Holevo showed 

a 

that, for any measurement, the mutual information / between the prepara- 
tion and the measurement result is bounded above by 

i<x = s{p)-Y.Po^s{p^), (1) 

a 

where S{p) = — Trplogp. Holevo ^ and Schumacher and Westmoreland 
|1] proved that, with appropriate choices of code and decoding observable, 
this upper bound can be approached asymptotically. Therefore, x measures 
the classical information that can be conveyed using a particular ensemble 
of quantum states. 

The quantity x ^ 0? with equality if and only if all of the possible states 
Pa are the same. We can say even more. The only situation in which zero in- 
formation is provided by any measurement is the situation in which all of the 
possible states are the same. Since Alice wishes to exclude the eavesdropper, 
she must arrange that her various operations always lead to the same output 
state of A. That is, x^ = 0. 

However, Alice and Bob want to make sure that x"^^ > 0; since Bob 
needs to read the secret message by an AB measurement. Let p"^^ be the 
initial "key" state of AB. Only the correlations within p"^^ permit Alice and 
Bob to communicate at all. If the initial state p^^ is a product state, then 
it must remain a product state regardless of Alice's manipulation of it — and 
always the same product state, since p^ is unchanged and Alice's final state 
(7^ is fixed. Even with both A and B in his possession. Bob will not be able 
to infer anything about Alice's choice of operation, because he will always 
have the state a^ ® p^ . Without correlations, the "key" state p^^ is useless. 

We now put this intuitive observation on a more quantitative basis. Imag- 



ine that Alice performs the operation £^ on A with probabihty Pa- We write 



^AB 
^a 



[S^ ® I^) p^^ (2) 
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AB V^ „ AB 



Ep«^« ■ (3) 



To exclude the eavesdropper, we require that a"^ = a^ for every a. The 
information that Alice can send to Bob will be limited by 

X^' = S{a^')-j:Pc.S{a^'). (4) 



The entropy of the average state a"^^ is subadditive, so that S [o'"^^) 
S (a^) + S (a^) (with equality if and only if a"^^ = cr"^ (g) a^). Thus, 



< 



X^'<S{a^)+S{a^)-j:p.S{a^^). (5) 

a 

Note that a^ = p^ (since Alice only operates on A) and that, by assumption, 
the individual final A states satisfy a^ = a^ for all a: 

X^' <S{p')^Y.Pc.{S {at) - S (a^ ) ) • (6) 

a 

No operation on A alone can lead to an increase in the coherent information 

US^- '5^^, so that for all a. 



S [<^t) - S (a^ ) < S (p^) - S (p^^) . (7) 

Therefore, 



X^' < S [p^) + S (p«) - S [p^^) . (8) 

The quantity on the right is Ip{A : B), the quantum mutual information 
between A and B, a measure of the degree of correlation in the original state 
p^^. We have shown that the information that Alice can transmit secretly 
to Bob using p^^ as a one-time pad is bounded above by Ip{A : B). 



2 A special case 

Having shown that x^^ ^ -^p(^ : -B), we will now show that Alice can choose 
an ensemble of operations so that x"^^ ~^ ^p{^ • -S) asymptotically. Since we 



know that we can achieve x^^ ^^ ^^ asymptotic information rate, it follows 
that Alice can send up to Ip{A : B) bits per key to Bob while keeping Eve 
completely excluded. 

To do this, we will only need to consider unitary operations on A, given 
by unitary operators U^. The new A states will be exactly the same as the 
original "key" state of A, so that 



< = U^P^'U, 



ATI t 



P 



(9) 



0. 



for all a. This amounts to saying that U^^p^ 

We will first consider a special case in which we can make x^^ = ^pi.A : B) 
in a single composite system, without the need for an asymptotic argument. 
Suppose that the initial A state is maximally mixed on a subspace, so that 
p^ = ifl (where 11 is the projection onto a rf- dimensional subspace). Then 
any unitary operator on A that commutes with 11 will leave p^ invariant. 



Let us choose basis states 



k^) for the support of 11 and write 



P 



AB 



El*")(' 



kl 



<■ 



(10) 



By considering p^ = Ti aP"^^, we can see that the B operators w^i satisfy 

P^ = E^f/c- (11) 



What operators U^ does Alice include in her ensemble? We will say that 
her ensemble includes 

k^) basis states; 



• All possible relative phase flips among the 

• All permutations of the k"^) basis states; and 

• All combinations of these. 

There are N such operators, and Alice uses each with probability 1/A^. Thus, 

f/f ^) w^ 



cr„ 



AB 



kl 



k^) l^ 



hi 



a 



AB 



kl \ ^ ^ a 



k^) I 



t/f ®< 



(12) 
(13) 



Consider the sum in the second expression. When k ^ I, the sum over a 
contains all relative phase flips among the A basis states with equal weights. 
In this case the sum must equal zero. The expression for a^^ becomes 



a^^ 



T.[-^EU^\k^){ky^')®^k,- (14) 



The sum over a also includes all permutations among the A basis states. 
This means that the result of this sum is independent of k. We conclude 
that the average state a^^ is a product state, namely 

a^^ = p^®pS. (15) 

For each a, a^^ is just the original state p^^, rotated by the unitary 
operator U^. This rotated state will have the same entropy as the original. 
It follows that 

AB of^AB\ V^ „ o f ^AB 



X^"" = S(a^^]-j:p^S 



cr„ 



= S (p^) + S (p^) - S (p^^) (16) 

= IM--B). (17) 

In this special case, then, we can arrange for x^^ to achieve its upper bound 
oi Ip{A : B) exactly. 

Notice how this works. We have arranged Alice's ensemble of operations 
so that the correlations between A and B completely disappear on average — 
leaving cr^^ a product state. Let us think about this more generally. Once 
again, we suppose that we have a bunch of unitary operators U^ acting on 
A, which do not alter the subsystem state p^. We have 

^AB ^ S {a^^) - S {p^') (18) 

(since for each a the state a^^ has the same entropy as p"^^). Noting that 
(jA = pA g^]2d a^ = P^ , we can rewrite this as 

X^^ = /p(A:5)-/.(A:5), (19) 

where Ip{A : B) and Ia{A : B) are the mutual informations for p"^^ and 
(jAB^ respectively. In other words, x^^ is exactly the amount by which we 
have, on average, reduced the mutual information between the systems. In 



our special case, where the subsystem A is completely mixed, we can reduce 
this all the way to zero, and so x^^ = ^p{^ '■ B). 

This points up a connection between our analysis and the work of Gro- 
isman et al. [6j , who define the "total correlation" of two systems to be 
the amount of classical information that must be added to the system so 
that the correlations can be completely eliminated by local operations. They 
show that the total correlation is given by the quantum mutual information. 
The elimination of correlations is not our aim; rather, we wish to maximize 
X^^ subject to the strict privacy condition that x^ = 0. Nevertheless, Equa- 
tion UHl tells us that these two tasks are closely related. 

3 The general case 

Now let us consider a general state p^^. The subsystem state p^ has D 
distinct eigenvalues \k- For a given K, the eigenspace of Xk has dimension 
dk- We can therefore choose a basis of p"^ eigenstates and write 

D / dK \ 

P^=Y.^k\ E \KmK){KmK\ . (20) 

K=l \m.K=l I 

For a given K^ we think of the basis states \Kmi^) as comprising a "block" 
spanning the ^K-dimensional eigenspace of \k- This block has total "weight" 
Pk = d-K^K in this mixture. We can write 

P^ = E^i^PK, (21) 

K 

where each of the p^ is the density operator that is maximally mixed on the 
eigenspace of Xk'- 

pi = J2^\KmK){KmK\. (22) 



dK 



The joint state p^^ can be written 



pAB 



E ( E \KmK){Ln,\ ® w^^^.A . (23) 

KL XniKUL / 

What can we say about the operators WKraKLuL^^ If "^^ compare the partial 
trace of this expression with Equation 1201 we see that 

Tr W^ Lnr = Ax ^KL ^n^KUL ■ (24) 



Thus, given a value of K, 

Y. ^KniKK^K = PkPk (25) 

for some density operator p^. This will be useful below. 

Notice that, for various values of K, the density operators p^ have or- 
thogonal supports. In general, we can make no such claim about the supports 
of the density operators p^. 

As before, Alice will perform unitary operations on A that do not change 
the subsystem state p^. The operators U^ include 

• All relative phase flips between distinct blocks; 

• All relative phase flips between basis states within each block; 

• All permutations of the basis states within each block; and 

• All combinations of these. 

Again, we say that there are A^ such operators, and Alice uses each with 
probability 1/A^. 

The resulting average state a^^ is 



0-^^ 



E E (^j:U^\KmK){Ln,\U^^) ®w^^^,^^. (26) 



Since the average over a includes all phase flips between distinct values of K 
and L, the average in parentheses is zero unless K = L, so 



^''^ = E E (^T.U^\Km^){KnK\U^'] 

K niK-riK \ a J 



®<m^Kn^- (27) 



Also, we include all phase flips between distinct values oirriK and uk-, so the 
sum becomes 



KniK \ " / 



■iriK 



®<m,,Km,- (28) 



Finally, since the U^ operators include all permutations of basis states within 
a given block, the average in parenthesis depends only on K and not on mx- 



Indeed, this average is the uniform density operator on the Ai^-eigenspace 
for p"^, which is just p;^. This means we can write 

^^^ = E^^Px®pf- (29) 

K 

From this, noting that the pj^ operators have orthogonal supports, we 
can calculate the quantum mutual information Ia{A '■ B) to be 

lM--B) = S{p^)-j:PKS{pf,). (30) 

K 

The right-hand side of this equation is bounded above by \ogD, the logarithm 
of the number of distinct eigenvalues of p^ (and thus the number of values 
of the eigenvalue index K). Therefore, 

hiA:B)<\ogD. (31) 

Alice can therefore achieve a Holevo bound for the composite system satis- 
fying 

X^''>lM-B)-\ogD. (32) 

Now consider the asymptotic problem. Alice and Bob share a large num- 
ber n of copies of the pair AB, so that their initial joint state is [p ) 
The quantum mutual information of this state is just nIp{A : B). Alice 
performs operations on all of her copies together such that the final state of 
these copies is always the same. Alice's systems are delivered to Bob, who 
will try to distinguish which operation Alice performed. Regardless of Alice's 
operations, 

-X^^^^'"<IM--B). (33) 

n 

We will now show that, for a suitable ensemble of operations, Alice can 
approach equality, and therefore Ip{A : B) is an asymptotically achievable 
information rate from Alice to Bob as n — i> oo. 

First, we note that [p ) is a highly degenerate state for large n. If the 
Hilbert space Ti.^ has dimension d, then (Ti^)*^" has dimension cF' (exponen- 
tial in n), but the state [p"^) has no more than (n + 1)'^ (polynomial in n) 
distinct eigenvalues. These distinct eigenvalues correspond to the type classes 
[7j of sequences of ra i.i.d. random variables, each having d values. Therefore, 
if we use our previous method to choose an ensemble of unitary operators for 



Alice's systems that each leave [p ) unchanged, we can create an ensemble 
of (A5)®" states such that 

^{ABr- > nIp{A : B) - log(n + 1)'^. (34) 

Therefore, 

-x(^^)'">/p(^:5)--log(n+l). (35) 

n n 

Since the second term goes to zero as n ^ oo, we have found a sequence of 

procedures such that 

lim-x(^^)^" = /p(A:i?). (36) 

The mutual information Ip{A : B) is therefore the information capacity from 
Alice to Bob if Alice can perform only local operations on the A systems 
that always lead to the same A state (and will thus completely exclude any 
eavesdropper with access only to A). 



4 Slightly insecure 

Note that we have required absolute perfection — that is, we have required 
that, by examining system A by itself, the eavesdropper Eve cannot get any 
information at all. No matter what operation Alice performs, the final A 
state is exactly the same. But what if we relax this requirement? Since Alice 
now has a wider range of operations at her disposal, she should be able to 
increase the Holevo bound x^^^ ^^(^ thus the information that she can deliver 
to Bob. If Eve has access only to a finite specified amount of information, 
how much additional capacity can Alice and Bob achieve? We will now show 
that the extra capacity from Alice to Bob is no larger than the Holevo bound 
X^, which in turn bounds the accessible information of the eavesdropper. 
Thus, if the protocol is only slightly insecure {x^ is small), the information 
capacity is only slightly increased. 

We begin with the key state p^^, and Alice performs the operation S^ 
on A with probability Pa- We do not require the operations to be unitary. 
As before, the final states are 

^^ = ^Hp"") (37) 



af^ 



a 



a 



Et ® I"" (p^"") (38) 

Y.V.ot (39) 

Ep.^r- (40) 



a 



Then 

X^^ -X^ = S (a^^) - S {a^) + El>. (^ (pf ) " ^ (pf^)) • (41) 

a 

By Equation [3 remembering that S (a^) = S (p^j for A operations, this 
becomes 

X^^-X^ < S (a^^) - S (a^) + S {p^) - S (p^^) (42) 

= IpiA:B)-h{A:B) (43) 

< /p(A:i?). (44) 

Thus, 

X^^ < /p(A : B) + x^. (45) 

Allowing a small non-zero x"^ can only increase x^^ by that same small 
amount. 



5 Remarks 

In our analysis of the quantum problem, we have also proven the analogous 
classical result. That is, suppose Alice and Bob possess a pair of correlated 
random variables Xa and Xb- Alice encodes her message by performing one 
of several possible operations on her own variable X^. To prevent Eve (who 
has access to Xa) from reading the message, she arranges for the marginal 
probability distribution of Xa to be independent of her message. Bob receives 
Xa and reads the message by examining the joint value {Xa, Xb)- In such a 
situation, the maximum achievable secure communication rate from Alice to 
Bob is the classical mutual information / {Xa '■ Xb)- This follows from our 
quantum result in the case that the quantum state of the composite system 
AB is a mixture of products of states drawn from orthogonal sets for A and 
B. 
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In other words, our analysis tells us that the mutual information is the an- 
swer to the same communication problem in both the classical and quantum 
settings. This illuminates the connections between classical and quantum 
information ideas. In particular, it sheds light on the meaning of the mu- 
tual information functional as a measure of the degree of correlation between 
physical systems. 
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